New Rust-based Ransomware Family Targets Windows, Linux, and ESXi Systems

Kaspersky security researchers have disclosed details of a brand-new ransomware family written in Rust, making it the third strain after BlackCat and Hive to use the programming language.

Luna, as it's called, is "fairly simple" and can run on Windows, Linux, and ESXi systems, with the malware banking on a combination of Curve25519 and AES for encryption.

Both the Linux and ESXi samples are compiled using the same source code with some minor changes from the Windows version.

Advertisements for Luna on darknet forums suggest that the ransomware is intended for use only by Russian-speaking affiliates. Its core developers are also believed to be of Russian origin owing to spelling mistakes in the ransom note hard-coded within the binary.

Luna confirms the trend for cross-platform ransomware, adding how the platform agnostic nature of languages like Golang and Rust are giving the operators the ability to target and attack at scale and evade static analysis.

 There is very little information on the victimology patterns given that Luna is a freshly discovered criminal group and its activity is still being actively monitored.
Luna is far from the only ransomware to set its eyes on ESXi systems, what with another nascent ransomware family known as Black Basta undergoing an update last month to include a Linux variant.

Black Basta is also notable for starting up a Windows system in safe mode before encryption to take advantage of the fact that third-party endpoint detection solutions may not start after booting the operating system in safe mode. This enables the ransomware to go undetected and easily lock the desired files.